docs(site): v0.15.0 truth-pass (signed models on every host, Core ML opt-in, current pins)

package.json

@@ -13,7 +13,7 @@
   },
   "dependencies": {
     "astro": "7.3.5",
-    "traverse-embedder-web": "^0.14.0"
+    "traverse-embedder-web": "^0.15.0"
   },
   "devDependencies": {
     "@playwright/test": "^1.63.0"

src/components/Footer.astro

@@ -11,7 +11,7 @@
         </div>
         <p>Contract-driven WASM runtime for device-independent business capabilities.</p>
         <div style="margin-top:1rem;display:flex;gap:0.5rem">
-          <span class="badge">v0.14.0</span>
+          <span class="badge">v0.15.0</span>
           <span class="badge">Apache 2.0</span>
         </div>
         <div class="footer-social">

src/pages/changelog.astro

@@ -2,12 +2,13 @@
 import SubpageLayout from '@layouts/SubpageLayout.astro';
 ---
 
-<SubpageLayout title="Changelog: Traverse Framework" description="Traverse release history and current v0.14.0 release highlights." canonical="https://traverse-framework.com/changelog.html" crumbs={[{ label: 'Home', href: '/' }]}>
+<SubpageLayout title="Changelog: Traverse Framework" description="Traverse release history and current v0.15.0 release highlights." canonical="https://traverse-framework.com/changelog.html" crumbs={[{ label: 'Home', href: '/' }]}>
   <main class="changelog-wrap">
     <div class="section-label">Changelog</div><h1 class="t-h1">Release history</h1>
     <p class="t-body t-muted">What shipped in Traverse. Each release is backed by versioned, reviewable work.</p>
     <p><a href="https://github.com/traverse-framework/traverse/releases" class="btn btn-ghost btn-sm" target="_blank" rel="noopener">View all releases on GitHub →</a></p>
-    <article class="release"><aside><strong>v0.14.0</strong><p>September 29, 2026</p><span class="badge badge-success badge-dot">Latest</span></aside><div><h2 class="t-h2">Signed exact-ref models + digits-mlp</h2><p>v0.14.0 is a minor lockstep crate + npm release with breaking Spec 138 exact-ref surface changes (0.x minor convention). Model manifests move to schema <code>2.0.0</code> with detached Ed25519 <code>model.sig.json</code>; host-owned trust roots; first trained <code>digits-mlp-1.0.0</code> (test-only key; production signing tracked separately). Discover → execute → trace, on one shared <code>runtime.wasm</code>. Published exact-ref execute is native Rust and the web embedder in this cut, plus Swift <code>ExactModelHost</code> on xcframework <code>swift-host-v0.14.0-4</code> (<code>Package.swift</code> pin; first on <code>swift-host-v0.14.0-1</code>, #1579 closed 2026-09-30). Kotlin <code>ExactModelHost</code> is on main (#1580) and is not in Maven Central 0.14.0. .NET <code>ExactModelHost</code> is on main (#1602) and is not in nuget.org <code>TraverseEmbedder</code> 0.14.0. Next package cuts: #1651. Pin the Traverse crates and npm at <code>0.14.0</code>. That release pins <code>traverse-registry</code> at <code>=0.25.0</code>; crates.io has since published <code>traverse-registry</code> 0.27.0. Product Release: <a href="https://github.com/traverse-framework/traverse/releases/tag/v0.14.0">Traverse v0.14.0</a>.</p></div></article>
+    <article class="release"><aside><strong>v0.15.0</strong><p>October 13, 2026</p><span class="badge badge-success badge-dot">Latest</span></aside><div><h2 class="t-h2">Governed model execution on every host</h2><p>v0.15.0 is a minor lockstep crate + npm release with breaking Spec 138 exact-ref changes (this repo's 0.x convention uses a minor bump). Signed exact-ref packages now run on the Swift, Kotlin/Android, and .NET embedders, in addition to native Rust and the browser. Every host enforces model rights. Discover → execute → trace, on one shared <code>runtime.wasm</code>. No host is Certified under Spec 529.</p><ul><li><strong>ExactModelHost is published:</strong> Swift on the <code>swift-host-v0.15.0</code> xcframework (<code>Package.swift</code> on main pins that asset, <a href="https://github.com/traverse-framework/traverse/pull/1675">#1675</a>; the v0.15.0 tag itself still pointed at <code>swift-host-v0.14.0-4</code>). Kotlin <code>com.traverse-framework:traverse-embedder</code> 0.15.0 on Maven Central and .NET <code>TraverseEmbedder</code> 0.15.0 on nuget.org include <code>ExactModelHost</code> (<a href="https://github.com/traverse-framework/traverse/issues/1651">#1651</a>, closed).</li><li><strong>Breaking <code>model_usage</code>:</strong> an app with <code>exact_model_dependencies</code> must declare <code>model_usage</code> as <code>commercial</code> or <code>non_commercial</code>. Without it, calls fail closed with <code>usage_undeclared</code>.</li><li><strong>Third-party ONNX:</strong> <code>traverse-cli model</code> can digest, sign, verify, pin, and package an ONNX model onto an audited guest.</li><li><strong>Repeat inference:</strong> guest ABI v3 snapshot reuse makes a later call restore a prepared snapshot. The release describes that as faster repeat inference.</li><li><strong>Core ML is opt-in on Apple hosts:</strong> a package's signed Core ML variant runs under the same policy, tolerance, and evidence rules. The default placement stays <code>wasm-cpu</code>. Evidence so far is macOS <code>cargo test</code> plus the Decision 113 iPhone spike. Governed-path iPhone evidence is still open (<a href="https://github.com/traverse-framework/traverse/issues/1630">traverse#1630</a>). There is no web, Android, or desktop GPU adapter.</li></ul><p class="t-body t-muted" style="margin-top:0.75rem"><strong>Pins:</strong> crates.io, npm, Maven Central, and nuget.org at <code>0.15.0</code>. This release pins <code>traverse-registry</code> at <code>=0.28.0</code> (registry#636). <code>digits-mlp-1.0.0</code> remains a test-only key; production custody, rotation, and revocation are still <a href="https://github.com/traverse-framework/traverse/issues/1567">#1567</a>. The web embedder reports its real package version (<a href="https://github.com/traverse-framework/traverse/issues/1654">#1654</a>).</p><p>Product Release: <a href="https://github.com/traverse-framework/traverse/releases/tag/v0.15.0">Traverse v0.15.0</a> · <a href="https://github.com/traverse-framework/traverse/blob/main/docs/releases/v0.15.0.md" target="_blank" rel="noopener">Release notes</a> · <a href="https://github.com/traverse-framework/traverse/blob/main/docs/upgrade-to-v0.15.0.md" target="_blank" rel="noopener">Upgrade guide</a>.</p></div></article>
+<article class="release"><aside><strong>v0.14.0</strong><p>September 29, 2026</p></aside><div><h2 class="t-h2">Signed exact-ref models + digits-mlp</h2><p>v0.14.0 is a minor lockstep crate + npm release with breaking Spec 138 exact-ref surface changes (0.x minor convention). Model manifests move to schema <code>2.0.0</code> with detached Ed25519 <code>model.sig.json</code>; host-owned trust roots; first trained <code>digits-mlp-1.0.0</code> (test-only key; production signing tracked separately). Discover → execute → trace, on one shared <code>runtime.wasm</code>. Published exact-ref execute is native Rust and the web embedder in this cut, plus Swift <code>ExactModelHost</code> on xcframework <code>swift-host-v0.14.0-4</code> (<code>Package.swift</code> pin; first on <code>swift-host-v0.14.0-1</code>, #1579 closed 2026-09-30). Kotlin <code>ExactModelHost</code> is on main (#1580) and is not in Maven Central 0.14.0. .NET <code>ExactModelHost</code> is on main (#1602) and is not in nuget.org <code>TraverseEmbedder</code> 0.14.0. Next package cuts: #1651. Pin the Traverse crates and npm at <code>0.14.0</code>. That release pins <code>traverse-registry</code> at <code>=0.25.0</code>; crates.io has since published <code>traverse-registry</code> 0.27.0. Product Release: <a href="https://github.com/traverse-framework/traverse/releases/tag/v0.14.0">Traverse v0.14.0</a>.</p></div></article>
 <article class="release"><aside><strong>v0.13.0</strong><p>September 25, 2026</p></aside><div><h2 class="t-h2">App state machine and target-neutral host authorities</h2><p>v0.13.0 is a minor lockstep crate + npm release. Its throughline is the discover → execute → trace loop for governed, standalone embedder apps: Spec <code>139-embedder-app-state-machine-execution</code> lands the app command state machine that drives that loop end to end, and Spec <code>140-host-authority-wit-adapters</code> gives it target-neutral host authorities — including a real audio-input capability. crates.io and npm packages are at <code>0.13.0</code>.</p><ul><li><strong>App state machine (Spec 139):</strong> <code>app_command</code> envelopes (embedder-api 1.1.0) and the state machine driver across Swift, Kotlin, .NET, and web, validated against one shared cross-host golden event log. Decision 99: <code>invoke.input_from</code> resolves <code>host_connector_result.&lt;field&gt;</code> at runtime; <code>app validate</code> rejects an unreachable reference.</li><li><strong>Host authorities and audio-input (Spec 140):</strong> WIT host-adapter interfaces make host authorities target-neutral and runtime-owned (Decision 97), landing first for <code>traverse.audio-input</code>. Real adapters: Apple <code>AVAudioEngine</code> (verified on physical microphone hardware) and browser capture / permission. Bounded artifact staging shared by runtime, web, and Swift.</li><li><strong>Native publish pipelines:</strong> automated release workflows for Maven Central, nuget.org, and the Swift <code>TraverseSwiftHost.xcframework</code>; Kotlin <code>TraverseEmbedder</code> at embedder-api 1.1.0 parity.</li><li><strong>Security hardening (Decision 100):</strong> <code>RuntimeWasmHost</code> runs under explicit fuel and memory limits and fails closed on an out-of-bounds guest response; backup restore bounds decompressed archive-member size.</li><li><strong>Web fixes:</strong> event order under reentrant subscriptions, pinned and zero-major registry version ranges, non-string IndexedDB state keys rejected, accurate browser planner truncation, matching JSON types required in browser plans.</li></ul><p class="t-body t-muted" style="margin-top:0.75rem"><strong>Upgrade note:</strong> pin <code>traverse-embedder-web@0.13.0</code> with crates at <code>0.13.0</code> (lockstep). Apps using <code>invoke.input_from</code> with <code>host_connector_result.&lt;field&gt;</code> need Spec 139 <code>0.2.0</code> / Spec 138 <code>0.3.0</code> or later. Swift consumers: <code>TraverseSwiftHost</code> now resolves from the <code>swift-host-v0.13.0</code> release — there is no GitHub Release object for <code>v0.13.0</code> (immutable-releases policy). The certified <code>runtime.wasm</code> digest changes in this cut (<code>sha256:a254c161…</code>).</p><p><a href="https://github.com/traverse-framework/traverse/blob/main/docs/releases/v0.13.0.md" target="_blank" rel="noopener">Read the v0.13.0 release notes →</a> · <a href="https://github.com/orgs/traverse-framework/discussions/1552" target="_blank" rel="noopener">Announcement</a></p></div></article>
     <article class="release"><aside><strong>v0.12.0</strong><p>September 16, 2026</p></aside><div><h2 class="t-h2">Exact-ref governed model.execute</h2><p>v0.12.0 is a minor lockstep crate + npm release. Spec <code>138-governed-exact-model-execution</code> / ADR-0074 lands host-staged <code>traverse.model-runtime</code> / <code>model.execute</code> for exact pinned WASM model packages on native and browser <code>wasm-cpu</code>. crates.io and npm packages are at <code>0.12.0</code>.</p><ul><li>Host-owned package store, single-consume staged I/O refs, and fail-closed policy / pin / digest checks behind Spec 137 <code>model.execute</code>.</li><li>CPU-WASM guest ABI with the echo fixture under <code>fixtures/models/fixture-echo-1.0.0/</code>; connector contract <code>traverse.model-runtime</code> 2.0.0.</li><li><code>traverse-embedder-web</code> exports matching stage / execute / read helpers so browser hosts share the same envelope contract as native <code>ExactModelHostConnector</code>.</li></ul><p class="t-body t-muted" style="margin-top:0.75rem"><strong>Upgrade note:</strong> apps that want local exact-ref models must declare <code>exact_model_dependencies</code> and use matching <code>model_ref</code> digests — provider authority fields on <code>model.execute</code> payloads fail closed. Pin <code>traverse-embedder-web@0.12.0</code> with crates at <code>0.12.0</code>. Pin <code>traverse-registry =0.22.0</code> if you consume it directly. Certified <code>runtime.wasm</code> digest is unchanged from 0.11.0.</p><a href="https://github.com/traverse-framework/traverse/blob/main/docs/releases/v0.12.0.md" target="_blank" rel="noopener">Read the v0.12.0 release notes →</a></div></article>
     <article class="release"><aside><strong>v0.11.0</strong><p>September 16, 2026</p></aside><div><h2 class="t-h2">One real runtime.wasm across native and browser</h2><p>v0.11.0 is a minor lockstep crate + npm release. Native hosts and <code>traverse-embedder-web</code> drive the same nested-wasmi capability executor inside an application-owned <code>runtime.wasm</code>, instead of a canned WAT fixture or a hand-rolled TypeScript WASI/<code>emit_event</code> path. Spec 1402 is complete. crates.io and npm packages are at <code>0.11.0</code>.</p><ul><li>Nested-wasmi executor in <code>traverse-runtime-wasm</code>; shared engine-agnostic <code>emit_event</code> and placement validation in <code>traverse-contracts</code>.</li><li>Production <code>RuntimeWasmHost</code> driver; Swift/wasmi, Kotlin/Chicory, and .NET/Wasmtime conform against the real artifact; digest published via the native runtime artifact registry.</li><li>Browser <code>BundleEmbedder</code> and <code>composedWorkflow</code> load digest-verified <code>runtime/runtime.wasm</code> from the app bundle and retire the interim TypeScript executor.</li></ul><p class="t-body t-muted" style="margin-top:0.75rem"><strong>Upgrade note:</strong> app bundles must include <code>runtime/runtime.wasm</code> and <code>runtime/runtime.wasm.sha256</code>. Bundles without them fail closed at <code>init</code>. Pin <code>traverse-registry =0.21.0</code> if you consume it directly.</p><a href="https://github.com/traverse-framework/traverse/blob/main/docs/releases/v0.11.0.md" target="_blank" rel="noopener">Read the v0.11.0 release notes →</a></div></article>

src/pages/docs/quickstart.astro

@@ -3,10 +3,10 @@ import SubpageLayout from '@layouts/SubpageLayout.astro';
 import DocsSidebar from '@components/DocsSidebar.astro';
 ---
 
-<SubpageLayout title="Quickstart — Traverse Framework" description="Build Traverse and inspect a governed capability bundle with the current v0.14.0 quickstart." canonical="https://traverse-framework.com/docs/quickstart.html" crumbs={[{ label: 'Home', href: '/' }, { label: 'Docs', href: '/docs.html' }]}>
+<SubpageLayout title="Quickstart — Traverse Framework" description="Build Traverse and inspect a governed capability bundle with the current v0.15.0 quickstart." canonical="https://traverse-framework.com/docs/quickstart.html" crumbs={[{ label: 'Home', href: '/' }, { label: 'Docs', href: '/docs.html' }]}>
   <div class="docs-layout"><DocsSidebar active="/docs/quickstart.html" /><main class="docs-content">
     <div class="section-label">Getting started</div><h1 class="t-h1">Quickstart</h1>
-    <p class="t-body t-muted">Build the current runtime and inspect a governed bundle. This path works with Traverse v0.14.0 and Rust 1.94 or later.</p>
+    <p class="t-body t-muted">Build the current runtime and inspect a governed bundle. This path works with Traverse v0.15.0 and Rust 1.94 or later.</p>
     <pre><code>git clone https://github.com/traverse-framework/traverse.git
 cd traverse
 cargo build